5 ms·
TLDR it's not an attack, CF isn't a criminal, he's a CF customer and sees traffic spikes with a curl useragent.
by luckylion 5y ago
TLDR it's not an attack, CF isn't a criminal, he's a CF customer and sees traffic spikes with a curl useragent.
- ceejayoz 5y agoYeah, I'm not seeing much evidence of the allegations in this article. CloudFlare would be very, very stupid to have set up a cache stampede of the sort OP describes, and they don't use cURL as the user agent (https://support.cloudflare.com/hc/en-us/articles/200172556-When-does-Cloudflare-crawl-my-site- https://support.cloudflare.com/hc/en-us/articles/200172556-W...). I kinda wonder if someone's using https://workers.cloudflare.com/ https://workers.cloudflare.com/ to crawl their site daily. Or they just need to configure `ngx_http_realip_module` to get the originating user's IP address, if they're not currently processing the X-Forwarded-For header.
- deleted 5y ago[deleted]
- jgoyvaerts 5y agoYou left out the part where the requests are coming from Cloudflare IPs.
- luckylion 5y agoNo. If you're a CF customer, all traffic comes from Cloudflare IPs, that's how it works, they're providing a reverse proxy for you.
- scrollaway 5y agoCloudflare is a reverse proxy so all requests would be coming from cloudflare. Did the author look at the x-forwarded-for IPs?
- mixologic 5y agoIt really depends on whether all traffic from cloudflare IP's or just the most frequent ones. If the former, then they have configured nginx wrong and are logging the wrong source ip.
- scrollaway 5y agoI don't see evidence they aren't logging the wrong source IP (which is the default format with nginx, which the author is using). These are extraordinary claims, which require extraordinary evidence.
- donmcronald 5y agoTypically when you're using Cloudflare you configure your origin firewall to drop traffic that doesn't come from Cloudflare [1]. What would be the point of using Cloudflare if you also accept traffic that bypasses Cloudflare? How would you even set up the DNS for that? 1. https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/
- robertlagrant 5y ago> sees traffic spikes with a curl useragent And from Cloudflare IPs.
- ceejayoz 5y agoThat's how Cloudflare works. Traffic goes user --> Cloudflare --> your server, with an X-Forwarded-For header. The same happens with most load balancers. In Apache, you have to set up mod_rpaf or mod_remoteip. In Nginx, you have to configure ngx_http_realip_module.
- robertlagrant 5y agoYeah, I get that, but I'm replying to someone who doesn't seem to think the traffic came from Cloudflare.